Equiangular Spherical Codes in Quantum Cryptography 
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Quantum key distribution protocols based on equiangular spherical codes are introduced and 
their behavior under the intercept/resend attack investigated. Such protocols offer a greater range 
of secure noise tolerance and speed options than protocols based on their cousins, the mutually- 
unbiased bases, while also enabling the determination of the channel noise rate without the need 
to sacrifice key bits. For fixed number of signal states in a given dimension, the spherical code 
protocols offer Alice and Bob more noise tolerance at the price of slower key generation rates. 
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The possibility of secure key distribution using quantum 
states is by now a well established feature of quantum 
information theory. In the original 1984 proposal of Ben- 
nett and Brassard (BB84) (jy], four states of a spin- 1/2 
system, the eigenstates of az and of ax, are used as sig- 
nals by the sender Alice. These states are naturally par- 
titioned into two orthonormal bases from which the re- 
ceiver Bob chooses one at random to measure the signal. 
Because the bases are unbiased — i.e., the overlap between 
vectors from distinct bases is always the same, equal to 
1/2 for qubits — Bob learns nothing when his measure- 
ment doesn't correspond to Alice's preparation, but ev- 
erything when it does. The nonorthogonality of all the 
states allows Alice and Bob to detect eavesdropping by 
an adversary Eve, so the states form an unconditionally 
secure cryptographic protocol 2,,^^ . 

One more unbiased basis, the eigenvectors of (jy, can 
be added to the BB84 set, forming a six-state proto- 
col 0]. Unbiased bases can be found in higher dimen- 
sions as well 0, and the key distribution protocol has 
been extended to such cases, with increasing dimension 
leading to improved security j^. 

Here we introduce a new ensemble of signals, equiangu- 
lar spherical codes, and show that key distribution prot- 
cols based on them offer potential advantages over the 
unbiased bases. Our security analysis is based on the 
eavesdropper's use of the intercept/resend attack and, as 
such, doesn't provide firm proofs of security, but rather 
yields an insight into the workings and features of the 
protocol. The first feature is simplicity. Such protocols 
need not sacrifice potential key letters in order to estab- 
lish the amount of information Eve has learned about the 
whole key string. The success rate (sift rate) of the proto- 
col itself furnishes this information. Second, equiangular 
spherical codes offer a greater range of protocol security 
and key generation speed options for fixed dimension. 
Finally, for fixed number of signal states in a given di- 
mension, these protocols offer a higher noise threshold 
for secure operation but lower key generation rates than 
do the mutually- unbiased bases. 



Recall the general setting of quantum key distribution. 
Two parties, Alice and Bob, wish to make use of an au- 
thenticated public classical broadcast channel and an in- 
secure quantum channel controlled by an adversary Eve 
to establish a secret key for the purposes of encrypting 
and sharing other data. They start by using the clas- 
sical channel to fix a signal ensemble and a measure- 
ment for the quantum channel. Alice sends states drawn 
from the signal ensemble through the quantum channel to 
Bob, who performs the chosen measurement (in the case 
of signaling states drawn from mutually unbiased bases, 
the several measurement bases Bob chooses from for his 
measurement are here amalgamated into a single gener- 
alized measurement). Eve is free to exploit knowledge 
of the protocol and her control of the quantum channel 
to mount an attack on their protocol; she can in princi- 
ple subject the signal states to any physical interaction 
that she wishes. Effectively, this process produces a se- 
quence of samples from a certain tripartite probability 
distribution shared between the three parties. Alice and 
Bob then proceed to "distill" the key by communicat- 
ing information based on their individual sequences over 
the classical channel. Their goal is to exploit the quan- 
tum nature of the channel to make Eve's eavesdropping 
ineffective. 

The relevant probability distribution is the joint prob- 
ability p(ai, 6^, e^) of Ahce's signal, Bob's measurement 
result, and the result of whatever measurement Eve per- 
forms in the course of eavesdropping. Repeated use of the 
protocol yields a sequence of samples drawn from this dis- 
tribution. Alice and Bob, however, must establish which 
distribution they are sampling from, as it depends on 
Eve's attack. We imagine Eve has some physical setup 
which can give rise to many different distributions as she 
changes the strength of her interference with the chan- 
nel. Given an assumption of the type of attack, Alice 
and Bob determine the extent of Eve's interference by 
making public and comparing a fraction of the Alice's 
signals and Bob's measurement results. In this way they 
estimate the error rate of the channel, and together with 
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an assumption of the attack, determine the distribution 
p. From the remaining samples, which are supposed to 
be an asympotically large number M, say, they can dis- 
till a key of length MR in accordance with the following 
bounds: 

Ie <R <HA:B\E) , (1) 

where I{X :¥) = H{X) + H{Y) - H{XY) is the mutual 
information of X and Y , H{-) being the Shannon entropy, 
and Ie = HA : B) - min{/(A : E),I{B : E)}. The lower 
bound obtains when the key is distilled using one-way 
communication j^; to progress beyond this requires a 
technique called advantage distillation^ though this is of 
limited efficiency 0, 0| . 

These bounds provide a method of investigating the 
cryptographic usefulness of a protocol. Given a signal 
ensemble, Bob's measurement, and an assumption about 
the nature of Eve's attack, the probability distribution 
can be calculated, and the key rate bounds determined. 
In this way the security of the protocol against this attack 
is established. To say that a protocol is unconditionally 
secure is to demonstrate its security against all possible 
attacks. 

The focus now turns to Alice's signal ensemble and 
Bob's measurement. An intuitively appealing ensemble is 
a spherical code, a complex- vector-space version of points 
on a sphere whose minimal pairwise distance is maximal. 
The complex version, called the Grassmann packing prob- 
lem, asks for a set of unit vectors in whose maximal 
pairwise overlap is minimal When all these pair- 

wise overlaps are equal, this equiangular spherical code is 
called a Grassmann frame; i.e., a set C = {|0fc) G C'^IJJ^j^ 
for n > d is a Grassmann frame if 

= VjVfc. (2) 

Grassmann frames also arise as the solution to the 
"minimum energy problem." For a set of unit vectors 
C, call Vt{C) = J2j,k li^t'jlM?* the t-th order "potential 
energy" of the set of the vectors ^3 ■ The minimum en- 
ergy problem is to find C having n>d elements such that 
Vi = n^/c? and V2 is minimized. Note that n^/c? is the 
global minimum of Vi . This follows from considering the 
(at most) d nonzero (real) eigenvalues 7^ of the Gram ma- 
trix Gjk = {(t>]\4'k)- Clearly J2k^k^n and I]fc 7fc = ^1 (C)- 
These being the equations for a plane and a sphere, the 
minimum of Vi occurs if and only if all the jk are equal to 
n/d, whence Vi is bounded below by r? j d. Thus what is 
sought is the set of vectors with the minimum V2 energy, 
given minimum Y\ energy. 

To find a lower bound for the minimum of V2, let \jk = 
!(</':; |</'fc)P, and employ the same method again. We have 
immediately that X^j^it/c ^jk = Vi — n = n{n — d)/d and 
J2j^k ^'jk = ^2 — n, whence the minimum of V2 over all 
sets minimizing Vi is bounded below by making all the 



Xjk the same and given by Eq. When this lower 

bound is achieved, i.e V2 = n'^{n — 2d+ d^)/{n — 1), the 
result is a Grassman frame. 

The existence of Grassmann frames isn't established 
for arbitrary n and d, though some general statements 
can be made . They always exist for n ~ d + 1 (a 
regular simplex), but never when n > d^. For n < d^, 
when a Grassman frame exists, it is a spherical code, but 
for n > d^, spherical codes aren't equiangular. 

By minimizing Vi, Grassmann frames automati- 
cally form measurement POVMs, which can be used 
by Bob to detect Alice's signal. This is true be- 
cause S = J2k\'l^k){(t)k\ = {n/d)I, so that a POVM 
can be constructed from the subnormalized projectors 
(d/n)|0fc)(0fe|. To see this, fix an orthonormal basis 
{|e/c)} and consider the matrix Tjk = {ej\4>k)- The 
Gram matrix can be written as Gjk = {T'^T)jk, while 
Sjk = {TT'^)jk, so both have the same eigenvalues. When 
Vi is minimized, these d eigenvalues are all n/d, implying 
that the vectors form a resolution of the identity. 

By using the same ensemble as Alice, Bob's measure- 
ment confirms the signal she sent with probability d/n. 
Bob may also choose a measurement which attempts to 
repudiate some of Alice's signals, in a manner entirely 
similar to unambiguous state discrimination Be- 
cause the number of states is larger than the dimension 
of the space on which they are supported, it is impossible 
to unambiguously determine the signal Alice sent with 
nonzero probability. However, for any ensemble, a pari- 
tal determination may be made, a scheme which works 
as follows. First, partition the signal ensemble into the 
set of all subsets of size h. Then, for each subset, find 
the projector orthogonal to the span of the vectors in the 
subset. This procedure yields a measurement operator 
for each of the subsets. In order to find an orthogonal 
projector to the span, h must be restricted such that none 
of the subsets spans more than d — 1 dimensions. 

For general ensembles, the operators constructed by 
this procedure do not quite form a measurement; some 
additional "failure" outcome is required to make the en- 
tire set form a resolution of identity. Interestingly, this 
additional outcome appears not to be required when the 
signal ensemble is an equiangular spherical code. Numer- 
ical constructions starting with ESCs in modest dimen- 
sions always yields a proper POVM in which no "failure" 
outcome is necessary. Though both types of measure- 
ments deserve further study, we shall specialize to the 
case of confirmation protocols; repudiation protocols are 
developed for qubits in [l^ . 

Confirmation protocols are appealing because the ESC 
ensembles are the sets that are "least classical" in the fol- 
lowing sense 0. Consider using these quantum states 
as signals on a classical channel as follows. Instead of 
sending the quantum state, Alice performs the associ- 
ated measurement and communicates the result to Bob 
using a classical channel. Bob then prepares the asso- 
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ciated quantum state at his end. The fidehty of Bob's 
reconstruction with the input state, averaged over inputs 
and measurement results, measures how well the classical 
channel can be used to transmit quantum information. 
This fidelity is dV2/n'^, so among all ensembles which 
themselves form POVMs, Grassmann frames are hardest 
to transmit "cheaply" in this way. Eavesdropping on the 
communication between Alice and Bob makes the chan- 
nel more classical — Eve is essentially trying to copy the 
signal — so one might expect that Grassmann frames are 
useful in foiling the eavesdropper. 

Before examining their resistance to eavesdropping, we 
remark on how Alice and Bob can concretely use the 
equiangular spherical codes to accomplish secure key dis- 
tribution. Though a protocol satisfying the lower bound 
of equation^is guaranteed asymptotically, it may not be 
feasible in practice. Consider first the case of a noiseless 
quantum channel, i.e. no eavesdropping. In a length-A^ 
string of samples Alice and Bob will agree with probabil- 
ity d/n. When labelling the states to n — \, Bob's string 
h is simply Alice's string a plus a string 5 having a fraction 
{n—d)/n of non-zero elements. Alice can select a classi- 
cal error-correcting code C which can correct these errors, 
choose a codeword c randomly, and send a-t-c to Bob. He 
then simply subtracts this from his string to obtain c-\-5, 
from which he uses the error-correcting property to deter- 
mine the codeword c. From the Shannon noisy-channel 
coding theorem, there are roughly NI{A -.B) codewords, 
in accordance with the lower bound. 

When Eve has no information about the quantum sig- 
nals, the communicated string a + c tells her nothing 
about c, since it's effectively encrypted by a. Should Eve 
have some information about a, gleaned from her tam- 
pering with the quantum channel, Alice and Bob may 
proceed as before to establish c, and then use a privacy 
amplification procedure to shorten this string and remove 
any information Eve has about it. 

As formulated, this protocol is not particularly robust; 
Alice and Bob can do better by first announcing some of 
the signals not received, a procedure analagous to sifting 
in the case of mutually unbiased bases. Upon receipt 
of each signal. Bob publicly broadcasts m outcomes he 
did not obtain. If Alice's signal is among these, they 
throw it away and proceed to the next. For the signals 
which pass the test Alice and Bob relabel the remaining 
states in order from to n — m — 1 and follow the above 
procedure. This occurs with probability mj(n — 1) as 
Bob could send any of (",^^) outcomes and ("jZi) of these 
contain Alice's signal. The protocol itself succeeds with 
probability 



given by 



Psift 



n(n—\) — m{n^d) 
n{n— 1) 



(3) 



where we have implicitly defined the constant s. Mean- 
while, the key rate when using an n-word equiangular 
spherical code in d dimensions excluding m outcomes is 



d(n—l) 

R = \og[n-m] + — ^log[d(n-l)] 



^_ d{n 1) )^Yog[n-d]~\ogs. (4) 



The real question is how well the protocol tolerates at- 
tempted eavesdropping. To begin formulating an answer 
it is useful to consider the intercept /resend attack. Be- 
cause it is straightforward to analyze, it offers immediate 
insight into the usefulness of these protocols. A full treat- 
ment of the problem could involve Alice and Bob using 
quantum error-correcting codes to turn a noisy quantum 
channel into a smaller, noiseless channel. However, this 
is far too complicated for the first step in this analysis. 

In the intercept/resend attack we assume that Eve fixes 
a fraction q of signals to intercept. She measures those 
so chosen using the same equiangular spherical code as 
does Bob, resending him the output of this process. Eve 
simply guesses Alice's signal to be her outcome, unless 
it is excluded by Bob's announcement. In this case she 
may still guess, but retains the information that she was 
forced to do so. 

By delineating the various cases, it is uncomplicated 
to arive at the relevant quantities. First, the sift rate of 
the protocol depends on q as in the following expression. 
Letting t — s{n — 1) — qm{n — d){d — 1), the sift rate is 
now 



Psift = t/n{n-lf. 



(5) 



Alice and Bob's joint probability distribution is deter- 
mined by the agreeement probability 



Pa^ = {n-l){d{n-l)-q{n-d){d-l))/t. 



(6) 



Since Alice and Bob use the same ESC ensemble, Eve's 
joint probability with Alice is the same as with Bob. In 
order to account for the cases in which Eve measures the 
signal but this outcome is later excluded by the protocol, 
we may append an event to her probability distribution, 
denoted by ?. Now she has n — m+1 total outcomes, and 
the ? outcome functions as a guess as to the key letter 
in the cases it occurs. The joint probability of such an 
exclusion and the particular signal j is plainly the same 
for all j, and together with the probability of agreement 
between Alice and Eve, these quantities fully describe the 
overall distribution: 



P? 



qd{n — l)s/nt, 
1 — qs^ /nt. 



(7) 

(8) 



These quantities enable us to compute the lower bound 
on the optimal key rate in equation ^ Then we may de- 
termine the value of q such that R = 0, and from this the 
maximum tolerable error rate for a given n, m, d combi- 
nation. Finally, we can convert this error rate into the 
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corresponding channel depolarizing rate for the purposes 
of comparison with unbiased bases protocols. Consider- 
ing the error rate alone is misleading since for a noise- 
less channel Alice and Bob expect no errors, post sifting, 
when using unbiased bases, but do expect some errors 
when using the spherical codes. Better protocols remain 
secure at higher channel noise rates, and we pick the de- 
polarizing channel for simplicity. For the spherical codes 
the depolarizing rate r is related to the error probability 
Pq = 1 — via the expression 

s 

^ " m(d-l) 

n(n-l)(n-TO-l) 
m(rf-l)(n-l + m(pe-l)) 

For protocols using unbiased bases these expressions 
are much simpler; in fact it is easier to work with the 
mutual information expressions themselves. For a given 
probability of error between Alice and Bob, their shared 
information is simply the full amount less the corruption 
caused by the error: 

7(A:S) =l0gd + Pel0gPe + (l-Pe)l0g(l-Pe)/(rf- 1) 

(10) 

Eve gains information only if she measures in the correct 
basis, and the basis announcement step prevents her from 
incorrectly guessing Alice's signal. Thus she gains the 
full information logrf if she manages to measure in the 
correct basis. Letting k be the number of bases, this 
makes Eve's information q/klogd. The probability of 
error is {k—l){d—l)/kd, so in terms of error probability, 
Eve's mutual information is 

The sift rate of the protocol is always the probability 
1/k for Bob to measure in the same basis Alice prepared 
the state, regardless of Eve's interference. Finally, the 
equivalent depolarizing rate r for a given error rate Pe is 
simply r = p^d/ {d— 1). 

Now we can compare the various aspects of both proto- 
cols. The first difference comes from the sift rate. When 
using unbiased bases, the protocol will fail with prob- 
ability {k—l)/k no matter how noisy the channel. To 
determine the error rate, Alice and Bob must announce 
some of their created key letters so as to compare how of- 
ten they agree. Obviously these letters cannot be used in 
the key so they are sacrificed. However, for equiangular 
spherical codes the sift rate depends on the intercept rate. 
Successful execution of the protocol relies on the correla- 
tion between Bob's outcome and Alice's signal, thus the 
probability of successful sifting decreases as the noise in- 
creases. Further, Eve can't replace the signals with any 
others to increase the sift rate and attempt to mask her 
intervention on other signals, for she would need to know 



Alice's signal. Thus, there is no need to sacrfice key let- 
ters in order to estimate Eve's information. 

The second immediate difference is the increased num- 
ber of possible protocols using the equiangular spheri- 
cal codes. With unbiased bases Alice and Bob have the 
choice of using anywhere from 2 to (possibly) d+1 bases. 
Spherical codes offer more possibilities, as n may range 
from d+1 to d"^ and m from to n—2. This offers two 
advantages. The first is speed. In particular there are 
protocols involving fewer than 2d signals, the minimum 
for the unbiased bases. This translates into higher abso- 
lute key generation rates, the key generation rate times 
the sift rate. Suppose Alice and Bob use n = ad spheri- 
cal code states. Then the maximum key generation rate 
becomes log(d)/a -|- (a— l)/alog((a— l)/a) for large d, 
in contrast to at best log((i)/2 for imbiased bases. By 
choosing a < 2 Alice and Bob can find spherical codes 
which are faster than two unbiased bases. For example, 
consider 35 spherical code states in 25 dimensions. The 
key rate is roughly 3.4 bits per signal as compared to 2.3 
for two unbiased bases. 

The second advantage is security. Increasing m is sim- 
ilar to increasing the number of unbiased bases in that 
both lead to decreased key rate and increased maximum 
tolerable noise. For maximum security Bob may elect to 
announce all but two of the outcomes he didn't obtain, 
whereas for maximum speed Bob would choose m = 0. 
Figure 1 shows the maximum tolerable noise rate for two 
values of to, as a function of number of signal states in 
ten dimensions. The corresponding maximum error rate 
when using various numbers of unbiased bases is included 
for comparison. The case of to = n — 2 always yields an 
improved secure noise threshold over unbiased bases. 

These two advantages hold when considering all pos- 
sible ESC protocols in a fixed dimension and so are ap- 
propriate if only the dimension is constrained by the par- 
ticular hardware Alice and Bob wish to use. However, a 
direct comparison of the two protocols involves a tradeoff 
between speed and security for a fixed number of states 
in a given dimension. When using spherical code proto- 
cols, Alice and Bob are free to choose to to match the 
perceived error rate in the channel, so for each style of 
signal ensemble, fixing n and d specifies a concrete phys- 
ical setup with similar resources. For each protocol we 
may consider the pair consisting of maximum key genera- 
tion rate and the maximum tolerable error rate. Plotting 
the pairs for protocols having n signals in various dimen- 
sions we can determine the tradeoff for the two protocols. 
Figure 2 reveals that for n = 2d signals, the spherical 
code protocols offer more security (larger vertical values) 
but at the price of slower key generation (smaller hori- 
zontal values). 

Use of spherical codes has been applied here to a spe- 
cific model of quantum key distribution. However, they 
are immediately applicable to two variants of the "pre- 
pare & measure" protocol discussed here. First is the co- 
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FIG. 1: Maximum tolerable noise rate in the depolarizing 
channel as a function of number of elements in the equian- 
gular spherical code (n) and mutually-unbiased bases (kd) 
ensembles, each in d = 10 dimensions. Two ESC protocols 
are shown, above and below the MUB protocol. The upper 
curve corresponds to the maximal security case m — n — 2 
in which Bob excludes all but two outcomes, while the lower 
corresponds to m = n/2, exclusion of half the outcomes. The 
flexibility in number of elements n and number of ourcomes 
publicly excluded m provides an increased level of security 
over the unbiased bases. 
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FIG. 2: Speed/security pairs for ESC and MUB protocols 
using n — 2d signals. Each point represents the maximum 
key generation rate (horizontal axis) and maximum tolerable 
noise rate for the depolarizing channel (vertical axis) for that 
particular protocol. The three lines connect corresponding 
protocols between the two different signal ensembles and show 
that while the unbiased bases are faster for fixed n and d, the 
spherical codes are more robust. 



herent version of such protocols in which Alice prepares 
a bipartite state, ostensibly entangled, and sends half to 
Bob. Each party then measures his or her half, returning 
the protocol to the original picture. This method al- 
lows us to bring not only classical but quantum informa- 
tion processing tools to bear on the problem of security. 
Equiangular spherical codes fit nicely into this frame- 
work, as they can always be realized from maximally en- 
tangled states. Thus they start on the same footing as 



unbiased bases, for which this is also true. To demon- 
strate this, consider a spherical code C = {\(t>k)} and a 
"conjugate" code C* — {|(/)^)} formed by complex conju- 
gating each code state in the standard basis. Then it is 
a simple matter to show that |$) = iVd/n)"^). \(j)k)\4'k) 
is maximally entangled. Thus if Alice prepares this state 
and sends the second half to Bob, they can realize the 
"prepare-and-measure" scheme by measurement. 

Second, the full array of (P equiangular states is a 
tomographically-complete ensemble, like the full comple- 
ment of 1 unbiased bases 0| . Such sets are useful in a 
modified protocol in which Eve, instead of Alice, creates 
bipartite states and distributes one half to each of the 
two parties 0| , and as a test to ensure secret key gener- 
ation is possible . Now Alice and Bob need to perform 
quantum state tomography on their pieces to ensure the 
security of the protocol. Using the (P equiangular states 
again offers more security in this case. 

Investigating the intercept /resend attack yields an in- 
sight into how the spherical codes ultimately perform 
in comparison with unbiased bases, when the strongest 
eavesdropping attacks are considered. The spherical 
codes' flexibility in n and m leads to advantages in both 
speed and security, though not together in any one in- 
stance, all the while rendering unnecessary the proce- 
dure of sacrificing key letters to determine the error rate. 
For fixed resources, i.e. fixed number of states in a 
given dimension, spherical codes offer higher noise se- 
curity thresholds, but slower key generation rates. 

This hindrance may be possible to overcome, or at least 
ameliorate, for Bob's use of Alice's spherical code is al- 
most certainly not his best choice. That is, assuming that 
the secrecy capacity will increase with increasing classical 
capacity of the quantum channel, Bob's optimal measure- 
ment is likely not the spherical code used by Alice. This 
is evident in two dimensions for the two spherical codes, 
which we may think of in the Bloch-sphere representa- 
tion as a regular tetrahedron and three equally-spaced 
coplanar vectors. By inverting each vector in the ensem- 
ble the resulting combination of spherical code encoder 
and inverse spherical code decoder achieves a higher clas- 
sical capacity. In the case of the trine this is known to 
be the optimal measurement |20| and conjectured to be 
for the tetrahedron |21|. These are in fact the two qubit 
protocols based on the repudiation measurement alluded 
to earlier. Much the same is true in three dimensions, at 
least for the case of six equiangular states: an unenlight- 
ening numerical maximization produced the result that 
a unitarily-transformed version of the encoding spher- 
ical code yields a capacity of 0.638, a roughly 50% im- 
provement over the nominal capacity of 0.424 when using 
the same ensemble for encoding and decoding. An even 
greater classical capacity can be achieved by using a re- 
pudiation measurement, each outcome of which excludes 
two possible signal states. In this case the capacity jumps 
to 0.734. Neither of these strategies surpass the capacity 
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generated by using two unbiased bases, log[3]/2 « 0.792, 
but they narrow the gap. 
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